Prepare your organization for the quantum era
QRAMM provides a structured, evidence-based approach to assess and improve your organization's readiness for post-quantum cryptography migration.
Choose Your Path
Resources for every role
Whether you're building the business case, implementing controls, or mapping to compliance frameworks, QRAMM has you covered.
Security leaders
Build the business case for quantum readiness with executive briefings and ROI analysis.
Explore Resources →Security practitioners
Get hands-on implementation guides, cryptographic inventory tools, and migration checklists.
Explore Resources →Compliance teams
Map QRAMM to NIST, ISO 27001, CMMC, FedRAMP, and other regulatory frameworks.
Explore Resources →The Quantum Timeline
Where the quantum timeline stands
Quantum computers capable of breaking current encryption are approaching, and federal deadlines for the move to post-quantum cryptography are now set. Here is the context for planning.
Deployment figure from the DigiCert and Propeller Insights enterprise survey, 2025. Timeframes are expert estimates (Global Risk Institute quantum threat timeline).
The Framework
Four dimensions of quantum readiness
QRAMM provides comprehensive coverage across all aspects of cryptographic modernization.
Cryptographic Visibility & Inventory
CVIDiscover, catalog, and understand all cryptographic assets across your organization.
- Cryptographic Discovery & Inventory Management
- Vulnerability Assessment & Classification
- Cryptographic Dependency Mapping
Strategic Governance & Risk Management
SGRMEstablish leadership commitment and systematic risk management for quantum threats.
- Executive Leadership & Policy Management
- Risk Assessment & Compliance Management
- Third-Party & Supply Chain Risk
Data Protection Engineering
DPEImplement quantum-safe data protection across all data states.
- Data Classification & Protection Requirements
- Storage Security & Encryption Management
- Transit Security & Protocol Management
Implementation & Technical Readiness
ITRExecute quantum-safe technology deployment with minimal business disruption.
- Technology Infrastructure Assessment
- Integration Planning & Implementation
- Operational Readiness & Maintenance
Comprehensive assessment toolkit
The QRAMM Excel Toolkit provides everything you need to assess, score, and report on your organization's quantum readiness.
- 120 Assessment Questions across 4 dimensions and 12 practices
- Automated Scoring with weighted risk adjustments
- Compliance Mapping to NIST, ISO 27001, CMMC, FedRAMP
- Executive Dashboards with charts and visualizations
- Maturity Roadmap with prioritized recommendations
Open Source Tools
Free tools for quantum readiness
Production-ready open source tools to help organizations discover, assess, and migrate their cryptographic infrastructure.
CryptoScan
Cryptographic Discovery Scanner
Scan codebases for cryptographic vulnerabilities and quantum-risk algorithms. Supports 50+ detection patterns, multiple output formats (SARIF, CBOM, JSON), and remote Git repository scanning.
- Detect RSA, ECDSA, AES, MD5, SHA-1, and more
- Quantum risk classification for each finding
- SARIF output for GitHub Security integration
- CBOM generation for compliance
TLS Analyzer
TLS/SSL Configuration Analysis
Analyze TLS configurations, cipher suites, and certificate chains for quantum vulnerabilities. CNSA 2.0 compliance tracking and CBOM generation.
- CNSA 2.0 timeline assessment (2025-2035)
- Quantum risk scoring and remediation guidance
- Text, JSON, SARIF, HTML, and CBOM output formats
- Policy-based scanning with custom YAML configs
CryptoDeps
Dependency Crypto Analyzer
Analyze dependencies for cryptographic usage. Identify quantum-vulnerable algorithms in your npm, pip, Go, and Maven packages.
- Scan Go, npm, Python, and Maven dependencies
- Quantum risk classification (VULNERABLE, PARTIAL, SAFE)
- CycloneDX CBOM and SARIF output
- GitHub repository scanning
PQC-Bench
PQC Recommendation Engine
"What post-quantum crypto should I use?" Get natural language recommendations for NIST algorithms with sector-specific guidance and SNDL threat assessment.
- Natural language algorithm queries
- 7 critical infrastructure sector guides
- SNDL threat assessment
- Library production-readiness checks
Resource Library
Guides, templates & tools
Download practical resources to accelerate your quantum readiness journey.
Developed by CSNP
QRAMM is developed and maintained by CyberSecurity NonProfit (CSNP), a 501(c)(3) organization dedicated to advancing cybersecurity education and resources.
